<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>The Selective Symbolic Execution (S²E) Platform</title>
<link rel="stylesheet" href="./s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="the-selective-symbolic-execution-s2e-platform">
<h1 class="title">The Selective Symbolic Execution (S²E) Platform</h1>

<div class="contents topic" id="contents">
<p class="topic-title first">Contents</p>
<ul class="simple">
<li><a class="reference internal" href="#s2e-documentation" id="id2">S²E Documentation</a></li>
<li><a class="reference internal" href="#s2e-plugin-reference" id="id3">S²E Plugin Reference</a><ul>
<li><a class="reference internal" href="#os-event-monitors" id="id4">OS Event Monitors</a></li>
<li><a class="reference internal" href="#execution-tracers" id="id5">Execution Tracers</a></li>
<li><a class="reference internal" href="#selection-plugins" id="id6">Selection Plugins</a></li>
<li><a class="reference internal" href="#analysis-plugins" id="id7">Analysis Plugins</a></li>
<li><a class="reference internal" href="#miscellaneous-plugins" id="id8">Miscellaneous Plugins</a></li>
</ul>
</li>
<li><a class="reference internal" href="#s2e-development" id="id9">S²E Development</a></li>
<li><a class="reference internal" href="#s2e-publications" id="id10">S²E Publications</a></li>
</ul>
</div>
<p>Do not forget the <a class="reference external" href="FAQ.html">FAQ</a> if you have questions.</p>
<div class="section" id="s2e-documentation">
<h1>S²E Documentation</h1>
<ul class="simple">
<li>Getting Started<ol class="arabic">
<li><a class="reference external" href="BuildingS2E.html">Building S2E</a></li>
<li><a class="reference external" href="ImageInstallation.html">Preparing a VM image for S2E</a></li>
<li><a class="reference external" href="UsingS2EGet.html">Quickly uploading programs to the guest with s2eget</a></li>
<li><a class="reference external" href="TestingMinimalProgram.html">Testing a simple program</a></li>
<li><a class="reference external" href="Howtos/init_env.html">Testing Linux binaries</a></li>
<li><a class="reference external" href="Howtos/Concolic.html">Analyzing large programs using concolic execution</a></li>
<li><a class="reference external" href="EquivalenceTesting.html">Equivalence testing</a></li>
</ol>
</li>
<li>Analyzing Windows Device Drivers<ol class="arabic">
<li><a class="reference external" href="Windows/DriverTutorial.html">Step-by-step tutorial</a></li>
<li><a class="reference external" href="Windows/CheckedBuild.html">Setting up the checked build of Windows</a></li>
</ol>
</li>
<li>Analyzing the Linux Kernel<ol class="arabic">
<li><a class="reference external" href="BuildingLinux.html">Building the Linux kernel</a></li>
<li><a class="reference external" href="SystemTap.html">Using SystemTap with S2E</a></li>
</ol>
</li>
<li>Howtos<ol class="arabic">
<li><a class="reference external" href="Howtos/ExecutionTracers.html">How to use execution tracers?</a></li>
<li><a class="reference external" href="Howtos/WritingPlugins.html">How to write an S2E plugin?</a></li>
<li><a class="reference external" href="Howtos/Parallel.html">How to run S2E on multiple cores?</a></li>
<li><a class="reference external" href="Howtos/Debugging.html">How to debug guest code?</a></li>
</ol>
</li>
<li>S2E Tools<ol class="arabic">
<li>Available Tools<ol class="arabic">
<li><a class="reference external" href="Tools/ForkProfiler.html">Fork profiler</a></li>
<li><a class="reference external" href="Tools/TbPrinter.html">Trace printer</a></li>
<li><a class="reference external" href="Tools/ExecutionProfiler.html">Execution profiler</a></li>
<li><a class="reference external" href="Tools/CoverageGenerator.html">Coverage generator</a></li>
</ol>
</li>
<li><a class="reference external" href="Tools/DebugInfo.html">Supported debug information</a></li>
</ol>
</li>
<li><a class="reference external" href="FAQ.html">Frequently Asked Questions</a></li>
</ul>
</div>
<div class="section" id="s2e-plugin-reference">
<h1>S²E Plugin Reference</h1>
<div class="section" id="os-event-monitors">
<h2>OS Event Monitors</h2>
<p>To implement selectivity, S2E relies on several OS-specific plugins to detect
module loads/unloads and execution of modules of interest.</p>
<ul class="simple">
<li><a class="reference external" href="Plugins/WindowsInterceptor/WindowsMonitor.html">WindowsMonitor</a></li>
<li><a class="reference external" href="Plugins/RawMonitor.html">RawMonitor</a></li>
<li><a class="reference external" href="Plugins/ModuleExecutionDetector.html">ModuleExecutionDetector</a></li>
</ul>
</div>
<div class="section" id="execution-tracers">
<h2>Execution Tracers</h2>
<p>These plugins record various types of multi-path information during execution.
This information can be processed by offline analysis tools. Refer to
the <a class="reference external" href="Howtos/ExecutionTracers.html">How to use execution tracers?</a> tutorial to understand
how to combine these tracers.</p>
<ul class="simple">
<li><a class="reference external" href="Plugins/Tracers/ExecutionTracer.html">ExecutionTracer</a></li>
<li><a class="reference external" href="Plugins/Tracers/ModuleTracer.html">ModuleTracer</a></li>
<li><a class="reference external" href="Plugins/Tracers/TestCaseGenerator.html">TestCaseGenerator</a></li>
<li><a class="reference external" href="Plugins/Tracers/TranslationBlockTracer.html">TranslationBlockTracer</a></li>
<li><a class="reference external" href="Plugins/Tracers/InstructionCounter.html">InstructionCounter</a></li>
</ul>
</div>
<div class="section" id="selection-plugins">
<h2>Selection Plugins</h2>
<p>These plugins allow you to specify which paths to execute and where to inject symbolic values</p>
<ul class="simple">
<li><a class="reference external" href="Plugins/StateManager.html">StateManager</a> helps exploring library entry points more efficiently.</li>
<li><a class="reference external" href="Plugins/EdgeKiller.html">EdgeKiller</a> kills execution paths that execute some sequence of instructions (e.g., polling loops).</li>
<li><a class="reference external" href="Plugins/BaseInstructions.html">BaseInstructions</a> implements various custom instructions to control symbolic execution from the guest.</li>
<li><em>SymbolicHardware</em> implements symbolic PCI and ISA devices as well as symbolic interrupts and DMA. Refer to the <a class="reference external" href="Windows/DriverTutorial.html">Windows driver testing</a> tutorial for usage instructions.</li>
<li><em>CodeSelector</em> disables forking outside of the modules of interest</li>
<li><a class="reference external" href="Plugins/Annotation.html">Annotation</a> plugin lets you intercept arbitrary instructions and function calls/returns and write Lua scripts to manipulate the execution state, kill paths, etc.</li>
</ul>
</div>
<div class="section" id="analysis-plugins">
<h2>Analysis Plugins</h2>
<ul class="simple">
<li><em>CacheSim</em> implements a multi-path cache profiler.</li>
</ul>
</div>
<div class="section" id="miscellaneous-plugins">
<h2>Miscellaneous Plugins</h2>
<ul class="simple">
<li><a class="reference external" href="Plugins/FunctionMonitor.html">FunctionMonitor</a> provides client plugins with events triggered when the guest code invokes specified functions.</li>
<li><a class="reference external" href="UsingS2EGet.html">HostFiles</a> allows to quickly upload files to the guest.</li>
</ul>
</div>
</div>
<div class="section" id="s2e-development">
<h1>S²E Development</h1>
<ul class="simple">
<li><a class="reference external" href="Contribute.html">Contributing to S2E</a></li>
<li><a class="reference external" href="ProfilingS2E.html">Profiling S2E</a></li>
</ul>
</div>
<div class="section" id="s2e-publications">
<h1>S²E Publications</h1>
<ul class="simple">
<li><a class="reference external" href="http://dslab.epfl.ch/proj/s2e">S2E: A Platform for In Vivo Multi-Path Analysis of Software Systems</a>.
Vitaly Chipounov, Volodymyr Kuznetsov, George Candea. 16th Intl. Conference on
Architectural Support for Programming Languages and Operating Systems
(<a class="reference external" href="http://asplos11.cs.ucr.edu/">ASPLOS</a>), Newport Beach, CA, March 2011.</li>
<li><a class="reference external" href="http://dslab.epfl.ch/pubs/ddt">Testing Closed-Source Binary Device Drivers with DDT</a>. Volodymyr Kuznetsov, Vitaly Chipounov,
George Candea. USENIX Annual Technical Conference (<a class="reference external" href="http://www.usenix.org/event/atc10/">USENIX</a>), Boston, MA, June 2010.</li>
<li><a class="reference external" href="http://dslab.epfl.ch/pubs/revnic">Reverse Engineering of Binary Device Drivers with RevNIC</a>. Vitaly Chipounov and George Candea. 5th
ACM SIGOPS/EuroSys European Conference on Computer Systems (<a class="reference external" href="http://eurosys2010.sigops-france.fr/">EuroSys</a>), Paris, France, April 2010.</li>
<li><a class="reference external" href="http://dslab.epfl.ch/pubs/selsymbex">Selective Symbolic Execution</a>. Vitaly
Chipounov, Vlad Georgescu, Cristian Zamfir, George Candea. Proc. 5th Workshop
on Hot Topics in System Dependability, Lisbon, Portugal, June 2009</li>
</ul>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="index.rst">View document source</a>.

</div>
</body>
</html>
